14

I'm currently developing an application which needs to have the ability to manage users. If a hacker would have access to the administrative section, he would have access to sensitive information and/or could delete user accounts etc.

So I had the idea to split the application into two applications, one hosted on a public server for the users and the other one hosted on a private server, only accessible from inside a specific network.

I'm fairly new to application security, so could someone please tell me if this is a good idea or, and if not, why?

|improve this question
  • 8
    It's quite a common structure for high security applications - even some CMS for websites do this. The main risk is exposing the administrative tool in some way and accidentally leaving it as a gateway to the private network. – Matthew Jun 7 '16 at 6:37
  • 6
    The other risk is that the private application is assumed to be secure, are proper secure code analysis and vulnerability analyses are not performed, since it is assumed to be hidden. However, this is a very common pattern and is a good idea. – Jedi Jun 7 '16 at 6:44
  • I think this is often a good idea. But make sure to follow through with the separation all the way down the stack. E.g. make sure that the user application and the admin application use different database users with only the necesarry priviliges. – Anders Jun 7 '16 at 7:54
  • 1
    It depends on what exactly your application does. If it's a client-server application then all checks must be done on the server. So that even if someone manages to get a copy of admin app, it should be useless to him. As Jedi said, counting on the app to not get leaked is a very bad idea. Generally, you should write the server with assumption that client app IS compromised and there is a hacker using it, able to send any data he can imagine - and the server must handle that. – Agent_L Jun 7 '16 at 15:59
  • 1
    @Agent_L At no point do I suggest dropping application security. I suggest an additional low-cost but potentially high impact extra layer - if you need to be within the network, even if you have the admin application, it's an extra level of effort. – Matthew Jun 9 '16 at 12:29
21

Yes, it's a good idea: if you application allows it, it will make it possible to apply the principle of least privilege to a deployment, for instance by making sure the administrative interface can only be reached from "secure" networks.

It can be further improved by applying the same principle all over the stack: using the OS and database security systems to make sure different elements of the application only have access to the part of the data they really need.

The main risk is over-engineering the whole thing: splitting the application means defining mechanism for the different parts to communicate together (APIs). This is often an overlooked aspect of application security that can increase the attack surface of a potential attacker.

|improve this answer
  • While I agree with the principle of least privilege this should NOT be handled at the application level and should be handled at the DB level as described in my answer. – Bacon Brad Jun 7 '16 at 7:06
  • 1
    There are many ways to look it it depending on how the stack looks like. A web app, for instance, could limit admin access to an internal web site, making it harder to exploit stolen admin credentials. A n-tier app could use two different processes for regular or admin access using different service accounts with different DB-level security, etc. – Stephane Jun 7 '16 at 7:09
1

Like Stephane, I agree it can help your security, but it's go with an example:

Let's say you have your "user data" somewhere in your application, that holds email addresses, usernames, and passwords. (Probably in a DB)

You could create two DB accounts. One account is called "Nobody" and the other is called "Admin".

"Nobody" is used by your normal site, and it has the ability to:

  • Create an account
  • Ask the DB is user+password combo is correct
  • Change the password, if the old password is supplied with the new password

"Admin" on the other hand has full access to that table, and can do whatever it wants.

The advantage of doing things this way is that even if your public site is compromised, the attacker doesn't (yet) have full access to all of your hashed passwords. Your cleanup will still be a mess, but less of a mess than if he could read or modify your user accounts at will.

And yes, I'm ignored a lot of details, like what happens if someone forgets their password.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.